Vulnerabilities > CVE-2010-2730 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Microsoft Internet Information Services 7.5

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
microsoft
CWE-119
critical
nessus
NVD
Published: 2010-09-15
Updated: 2021-02-05

Summary

Buffer overflow in Microsoft Internet Information Services (IIS) 7.5, when FastCGI is enabled, allows remote attackers to execute arbitrary code via crafted headers in a request, aka "Request Header Buffer Overflow Vulnerability." Per: http://www.microsoft.com/technet/security/Bulletin/MS10-065.mspx 'FastCGI is not enabled by default in IIS.'

Vulnerable Configurations

Part Description Count
Application
Microsoft
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Msbulletin

bulletin_idMS10-065
bulletin_url
date2010-09-14T00:00:00
impactRemote Code Execution
knowledgebase_id2267960
knowledgebase_url
severityImportant
titleVulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS10-065.NASL
    descriptionThe version of IIS installed on the remote host has the following vulnerabilities : - Sending a specially crafted request for an ASP page on a website hosted by IIS can result in a denial of service. (CVE-2010-1899) - Sending a specially crafted HTTP request to an IIS server with FastCGI enabled can result in remote code execution. (CVE-2010-2730) - Sending a specially crafted request to an IIS server running on Windows XP can allow a remote attacker to bypass the need to authenticate to access restricted resources. (CVE-2010-2731)
    last seen2020-06-01
    modified2020-06-02
    plugin id49223
    published2010-09-14
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49223
    titleMS10-065: Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960)
    code
    #
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(49223);
  script_version("1.28");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id("CVE-2010-1899", "CVE-2010-2730", "CVE-2010-2731");
  script_bugtraq_id(41314, 43138, 43140);
  script_xref(name:"IAVA", value:"2010-A-0120");
  script_xref(name:"MSFT", value:"MS10-065");
  script_xref(name:"MSKB", value:"2124261");
  script_xref(name:"MSKB", value:"2271195");
  script_xref(name:"MSKB", value:"2290570");

  script_name(english:"MS10-065: Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960)");
  script_summary(english:"Checks versions of Asp.dll / Cgi.dll / Infocomm.dll");

  script_set_attribute(
    attribute:"synopsis",
    value:"The remote web server may allow remote code execution."
  );
  script_set_attribute(
    attribute:"description",
    value:
"The version of IIS installed on the remote host has the following
vulnerabilities :

  - Sending a specially crafted request for an ASP page
    on a website hosted by IIS can result in a denial of
    service. (CVE-2010-1899)

  - Sending a specially crafted HTTP request to an IIS
    server with FastCGI enabled can result in remote
    code execution. (CVE-2010-2730)

  - Sending a specially crafted request to an IIS server
    running on Windows XP can allow a remote attacker to
    bypass the need to authenticate to access restricted
    resources. (CVE-2010-2731)"
  );
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-065");
  script_set_attribute(
    attribute:"solution",
    value:
"Microsoft has released a set of patches for IIS on Windows XP, 2003,
Vista, 2008, 7, and 2008 R2."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2010/07/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2010/09/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/09/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS10-065';
kbs = make_list("2124261", "2271195", "2290570");
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);

get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(xp:'3', win2003:'2', vista:'1,2', win7:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
if (hotfix_check_iis_installed() <= 0) audit(AUDIT_NOT_INST, "IIS");

rootfile = hotfix_get_systemroot();
if (!rootfile) exit(1, "Failed to get the system root.");

share = hotfix_path2share(path:rootfile);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  # Windows 7 and Windows Server 2008 R2
  hotfix_is_vulnerable(os:"6.1", file:"Asp.dll", version:"7.5.7600.20741", min_version:"7.5.7600.20000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') ||
  hotfix_is_vulnerable(os:"6.1", file:"Asp.dll", version:"7.5.7600.16620", min_version:"7.5.7600.16000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') ||
  hotfix_is_vulnerable(os:"6.1", file:"Cgi.dll", version:"7.5.7600.20752", min_version:"7.5.7600.20000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2271195') ||
  hotfix_is_vulnerable(os:"6.1", file:"Cgi.dll", version:"7.5.7600.16632", min_version:"7.5.7600.16000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2271195') ||

  # Vista / Windows 2008
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"Asp.dll", version:"7.0.6002.22431", min_version:"7.0.6002.22000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') ||
  hotfix_is_vulnerable(os:"6.0", sp:2, file:"Asp.dll", version:"7.0.6002.18276", min_version:"7.0.6002.18000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') ||
  hotfix_is_vulnerable(os:"6.0", sp:1, file:"Asp.dll", version:"7.0.6001.22718", min_version:"7.0.6001.22000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') ||
  hotfix_is_vulnerable(os:"6.0", sp:1, file:"Asp.dll", version:"7.0.6001.18497", min_version:"7.0.6001.18000", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') ||

  # Windows 2003 / XP x64
  hotfix_is_vulnerable(os:"5.2", sp:2, file:"Asp.dll", version:"6.0.3790.4735", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261') ||

  # Windows XP x86
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Infocomm.dll", version:"6.0.2600.6018", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2290570') ||
  hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Asp51.dll", version:"5.1.2600.6007", dir:"\system32\inetsrv", bulletin:bulletin, kb:'2124261')
)
{
  set_kb_item(name:'SMB/Missing/MS10-065', value:TRUE);
  hotfix_security_warning();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}
  • NASL familyWeb Servers
    NASL idIIS_7_PCI.NASL
    descriptionAccording to the HTTP server banner the remote server is IIS 7.0. The server may be vulnerable to a number of vulnerabilities including a couple of remote code execution vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id108808
    published2018-04-03
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108808
    titleMicrosoft IIS 7.0 Vulnerabilities (uncredentialed) (PCI/DSS)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if(description)
{
  script_id(108808);
  script_version ("1.6");
  script_cvs_date("Date: 2018/07/13 15:08:46");

  script_cve_id(
    "CVE-2008-1446",
    "CVE-2009-3555",
    "CVE-2010-1256",
    "CVE-2010-1899",
    "CVE-2010-2566",
    "CVE-2010-2730",
    "CVE-2010-2731"
  );
  script_bugtraq_id(
    31682,
    36935,
    40573,
    42246,
    41314,
    43138,
    43140
  );
  script_xref(name:"MSFT", value:"MS08-062");
  script_xref(name:"MSFT", value:"MS10-040");
  script_xref(name:"MSFT", value:"MS10-049");
  script_xref(name:"MSFT", value:"MS10-065");
  script_xref(name:"MSKB", value:"953155");
  script_xref(name:"MSKB", value:"2124261");
  script_xref(name:"MSKB", value:"2271195");
  script_xref(name:"MSKB", value:"2290570");
  script_xref(name:"MSKB", value:"982666");
  script_xref(name:"MSKB", value:"973917");
  script_xref(name:"MSKB", value:"980436");
  script_xref(name:"IAVA", value:"2010-A-0120");
  script_xref(name:"IAVB", value:"2010-B-0045");
  script_xref(name:"IAVB", value:"2008-B-0075");

  script_name(english:"Microsoft IIS 7.0 Vulnerabilities (uncredentialed) (PCI/DSS)");
  script_summary(english: "Checks the web server banner.");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server may allow remote code execution.");
  script_set_attribute(attribute:"description", value:
"According to the HTTP server banner the remote server is
IIS 7.0. The server may be vulnerable to a number of
vulnerabilities including a couple of remote code execution
vulnerabilities.");
  script_set_attribute(attribute:"solution", value:
"Ensure the appropriate patches have been applied.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(189, 310);

  script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/03");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:iis");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Web Servers");

  script_dependencies("http_version.nasl");
  script_require_keys("www/iis", "Settings/ParanoidReport", "Settings/PCI_DSS");
  script_require_ports("Services/www", 80);
  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("http.inc");
include("misc_func.inc");

if (!get_kb_item("Settings/PCI_DSS"))
{
  audit(AUDIT_PCI);
}

if (report_paranoia < 2)
{
  audit(AUDIT_PARANOID);
}

get_kb_item_or_exit("www/iis");

app = "Microsoft IIS";
port = get_http_port(default:80);
banner = get_http_banner(port:port);
if (empty_or_null(banner) || "Server: Microsoft-IIS" >!< banner)
{
  audit(AUDIT_NOT_DETECT, app, port);
}

if ("Server: Microsoft-IIS/7.0" >!< banner)
{
  audit(AUDIT_LISTEN_NOT_VULN, app, port);
}

security_report_v4(severity:SECURITY_HOLE, port:port);
exit(0);

Oval

accepted2013-07-29T04:01:46.787-04:00
classvulnerability
contributors
  • nameDragos Prisaca
    organizationSymantec Corporation
  • nameDragos Prisaca
    organizationSymantec Corporation
  • nameMaria Kedovskaya
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Windows 7 (32-bit) is installed
    ovaloval:org.mitre.oval:def:6165
  • commentMicrosoft Windows 7 x64 Edition is installed
    ovaloval:org.mitre.oval:def:5950
  • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
    ovaloval:org.mitre.oval:def:6438
  • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
    ovaloval:org.mitre.oval:def:5954
  • commentMicrosoft IIS 7.5 is installed
    ovaloval:org.mitre.oval:def:6856
descriptionBuffer overflow in Microsoft Internet Information Services (IIS) 7.5, when FastCGI is enabled, allows remote attackers to execute arbitrary code via crafted headers in a request, aka "Request Header Buffer Overflow Vulnerability."
familywindows
idoval:org.mitre.oval:def:6933
statusaccepted
submitted2010-09-14T13:00:00
titleRequest Header Buffer Overflow Vulnerability
version43

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 43138 CVE ID: CVE-2010-2730 Microsoft Internet信息服务（IIS）是Microsoft Windows自带的一个网络信息服务器，其中包含HTTP服务功能。 对于启用了FastCGI功能的IIS服务器，远程攻击者可以通过提交特制的HTTP请求触发缓冲区溢出，导致执行任意代码。 Microsoft IIS 7.5 临时解决方法： * 禁用FastCGI。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS10-065）以及相应补丁: MS10-065：Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960) 链接：http://www.microsoft.com/technet/security/bulletin/MS10-065.mspx?pf=true
idSSV:20122
last seen2017-11-19
modified2010-09-17
published2010-09-17
reporterRoot
titleMicrosoft IIS FastCGI请求头远程溢出漏洞（MS10-065）

References